Configure Github workflow and job level permissions (#1602)

* Configure Github workflow and job level permissions * force CI run * Revert "force CI run" This reverts commit ab70476.
DataDog · Nov 8, 2024 · 4e19b91 · 4e19b91
1 parent b6f5372
commit 4e19b91
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 0 deletions.
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -5,6 +5,11 @@ on:
     paths:
       - "charts/**"
 
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
 jobs:
   changed:
     runs-on: ubuntu-latest

diff --git a/.github/workflows/go-test-private-action-runner.yaml b/.github/workflows/go-test-private-action-runner.yaml
@@ -8,6 +8,12 @@ on:
     paths:
       - 'test/private-action-runner/**'
       - 'charts/private-action-runner/**'
+
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
 env:
   GO111MODULE: "on"
   PROJECTNAME: "helm-charts"

diff --git a/.github/workflows/go-test.yaml b/.github/workflows/go-test.yaml
@@ -8,6 +8,12 @@ on:
     paths:
       - 'test/datadog-operator/**'
       - 'charts/datadog-operator/**'
+
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
 env:
   GO111MODULE: "on"
   PROJECTNAME: "helm-charts"

diff --git a/.github/workflows/pr-labeler.yaml b/.github/workflows/pr-labeler.yaml
@@ -4,10 +4,17 @@ on:
     branches:
       - main
 
+# Permission forced by repo-level setting; only elevate on job-level
+permissions:
+  contents: read
+  # packages: read
+
 jobs:
   label:
     name: Add label for PRs
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     timeout-minutes: 5
     steps:
       - uses: actions/labeler@v5

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -7,9 +7,14 @@ on:
     paths:
       - 'charts/**'
 
+permissions: {}
+
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      # https://github.com/helm/chart-releaser-action
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v3